docs: def sign(self, response):
          """Sign a response.
  
          I take a L{OpenIDResponse}, create a signature for everything
          in its L{signed<OpenIDResponse.signed>} list, and return a new
          copy of the response object with that signature included.
  
          @param response: A response to sign.
          @type response: L{OpenIDResponse}
  
          @returns: A signed copy of the response.
          @returntype: L{OpenIDResponse}
          """
          signed_response = deepcopy(response)
          assoc_handle = response.request.assoc_handle
          if assoc_handle:
              # normal mode
              # disabling expiration check because even if the association
              # is expired, we still need to know some properties of the
              # association so that we may preserve those properties when
              # creating the fallback association.
              assoc = self.getAssociation(assoc_handle, dumb=False,
                                          checkExpiration=False)
  
              if not assoc or assoc.expiresIn <= 0:
                  # fall back to dumb mode
                  signed_response.fields.setArg(
                      OPENID_NS, 'invalidate_handle', assoc_handle)
                  assoc_type = assoc and assoc.assoc_type or 'HMAC-SHA1'
                  if assoc and assoc.expiresIn <= 0:
                      # now do the clean-up that the disabled checkExpiration
                      # code didn't get to do.
                      self.invalidate(assoc_handle, dumb=False)
                  assoc = self.createAssociation(dumb=True, assoc_type=assoc_type)
          else:
              # dumb mode.
              assoc = self.createAssociation(dumb=True)
  
          try:
              signed_response.fields = assoc.signMessage(signed_response.fields)
          except kvform.KVFormError, err:
              raise EncodingError(response, explanation=str(err))
          return signed_response